security: Fix critical security vulnerabilities

- Remove secrets from Git (.env)
- Remove debug token endpoint
- Fix login to reject unauthorized access in production
- Remove HS256 fallback in JWT validation (RS256 only)
- Fix SQL injection in journal.go countQuery
- Fix CORS to use explicit origins only (no wildcard)
- Add security headers middleware (CSP, HSTS, etc.)
- Add input validation helpers
- Build successful

backend/main.go

@@ -146,6 +146,7 @@ func main() {
 	prometheus.MustRegister(requestDuration, requestCount, activeUsers)
 
 	r := chi.NewRouter()
+	r.Use(middleware.SecurityHeaders)
 	r.Use(middleware.CORS)
 	r.Use(hlog.NewHandler(logger))
 	r.Use(hlog.RequestIDHandler("req_id", "X-Request-ID"))
@@ -165,8 +166,13 @@ func main() {
 
 	r.Get("/health", handlers.NewHealthHandler())
 	r.Get("/api/v1/health", handlers.NewHealthHandler())
-	r.Get("/metrics", promhttp.Handler().ServeHTTP)
-	r.Get("/debug/token", handlers.DebugTokenHandler(cfg.JWTSecret))
+	
+	// Metrics endpoint - protected by API key in production
+	if cfg.Port == "9092" {
+		r.Get("/metrics", promhttp.Handler().ServeHTTP)
+	} else {
+		r.With(middleware.APIKeyAuth(os.Getenv("METRICS_API_KEY"))).Get("/metrics", promhttp.Handler().ServeHTTP)
+	}
 
 	// Auth endpoints (no auth required)
 	r.Post("/api/v1/auth/login", func(w http.ResponseWriter, r *http.Request) {
@@ -180,7 +186,14 @@ func main() {
 			return
 		}
 		
-		// Generera token direkt (förenklad för nu)
+		// TODO: Implement proper password verification against database
+		// For now, reject all login attempts in production
+		if cfg.Port != "9092" {
+			http.Error(w, `{"error":"authentication service unavailable"}`, http.StatusServiceUnavailable)
+			return
+		}
+		
+		// Development only - generate token without password check
 		token, err := jwtService.GenerateToken("3847477b-3d56-4975-9157-ae8f9ce52aa7", req.Email, "admin")
 		if err != nil {
 			http.Error(w, `{"error":"token generation failed"}`, http.StatusInternalServerError)
@@ -192,7 +205,7 @@ func main() {
 			"ok":         true,
 			"token":      token,
 			"token_type": "Bearer",
-			"expires_in": 2592000, // 30 dagar
+			"expires_in": 3600, // 1 hour - reduced from 30 days
 			"algorithm":  "HS256",
 			"user": map[string]string{
 				"id":    "3847477b-3d56-4975-9157-ae8f9ce52aa7",